ISO/IEC 27001 tells you to secure networks, but its Annex A controls on networks, network services and segregation are a few lines each, and they leave the design questions to you. ISO/IEC 27033 is the multi-part series that fills that gap: guidance on network security concepts, design, reference scenarios, security gateways, VPNs, wireless access and network virtualisation. This guide sets out each published part with its edition and status from the ISO catalogue, explains how the parts fit together, adds the machine identity controls the series does not spell out, and shows how to implement, evidence and map the guidance. It is written for network and security architects, ISMS managers and auditors who need to know which part to open for which problem. It describes the standards from their official catalogue entries and does not reproduce their text.
Key takeaways
- Seven published parts, guidance only. ISO/IEC 27033 has no certification of its own; it supports the network controls of an ISO/IEC 27001 ISMS.
- Part 1 is the roadmap. ISO/IEC 27033-1:2015 covers concepts, risk analysis, controls and architecture and points to the other parts. Start there.
- Several parts are old but confirmed. Parts 4 and 5 were reviewed and confirmed in 2025, Parts 1 and 6 in 2021, and Parts 2 and 3 in 2018. Part 7 on network virtualisation is the newest, published November 2023.
- Read it with current architecture in mind. The design guidance predates zero trust and SASE terminology; its risk-based method still works, but apply it to identity-aware access, not only to perimeters.
- Network devices are identities too. Gateways, VPN concentrators and controllers hold certificates, keys and service accounts that attackers target; secure them as rigorously as the traffic they inspect.
What it is and who it applies to
ISO/IEC 27033 is developed by ISO/IEC JTC 1/SC 27. According to the Part 1 catalogue entry, it addresses the security of devices, the management activities related to those devices, applications and services, end users, and information transferred across communication links. Its audience includes network owners and operators, senior and non-technical managers, security and network administrators, and anyone who plans, designs or implements network security architecture.
| Part | Title (short) | Edition and date | Status (ISO catalogue, checked 8 November 2026) |
|---|---|---|---|
| ISO/IEC 27033-1:2015 | Overview and concepts | Edition 2, August 2015 | Published; last reviewed and confirmed 2021. The independent ISO27k summary reports revision work restarting at preliminary stage |
| ISO/IEC 27033-2:2012 | Guidelines for the design and implementation of network security | Edition 1, 2012 (corrected version August 2012) | Published; last reviewed and confirmed 2018; replaced ISO/IEC 18028-2:2006 |
| ISO/IEC 27033-3:2010 | Reference networking scenarios: threats, design techniques and control issues | Edition 1, December 2010 | Published; last confirmed 2018; a later systematic review closed in March 2024 |
| ISO/IEC 27033-4:2014 | Securing communications between networks using security gateways | Edition 1, March 2014 | Published; confirmed 2025 |
| ISO/IEC 27033-5:2013 | Securing communications across networks using VPNs | Edition 1, August 2013 | Published; confirmed 2025 |
| ISO/IEC 27033-6:2016 | Securing wireless IP network access | Edition 1, June 2016 | Published; confirmed 2021 |
| ISO/IEC 27033-7:2023 | Guidelines for network virtualization security | Edition 1, November 2023 | Published, stage 60.60 |
Review outcomes change. Check each part's catalogue page before citing an edition in a contract, policy or audit report.
Structure and key requirements
The series moves from general to specific. Part 1 sets the method, Part 2 turns it into a design process, Part 3 applies it to common scenarios, and Parts 4 to 7 go deep on technology areas. Part 3's catalogue entry states that it refers to Parts 4 to 6 rather than repeating them.
| Part | Use it when | What it gives you (from the catalogue abstract) | Related NHI Mgmt Group guide |
|---|---|---|---|
| 1 | Setting network security policy or architecture principles | Definitions, how to identify and analyse network security risks and derive requirements, an overview of technical and non-technical controls, architecture guidance, and a roadmap to other parts | Network Security Guide |
| 2 | Running a network design or redesign project | How to plan, design, implement and document network security | Network Segmentation Guide |
| 3 | Reviewing architecture options for a known scenario | Threats, design techniques and control issues per reference scenario, used to choose and document a preferred design | Cloud Network Security Guide |
| 4 | Designing or reviewing firewalls, application firewalls and IPS | Threat identification for gateways, requirements, design techniques for common scenarios, and managing gateway controls through operation, monitoring and review | Firewall Management Guide |
| 5 | Site-to-site or remote access VPNs | Selecting, deploying and overseeing the technical safeguards for VPN connections between networks or for remote users | IPsec Security Guide |
| 6 | Enterprise wireless access | Threats, requirements, controls and design techniques for wireless networks, and monitoring of technical controls | 802.1X and EAP-TLS Enterprise Wi-Fi Guide |
| 7 | SDN, NFV, virtual switches and cloud virtual networks | Identifying security risks of network virtualisation and guidance to implement security in virtualised networks | Hypervisor and Virtualisation Security Guide |
The method in practice
- Risk first: Part 1 derives network security requirements from a risk assessment rather than from a product list. Tie it to the ISMS risk process so network decisions inherit the same risk owners and criteria.
- Documented design: Part 2 expects the design to be planned and documented. In practice: a zone model, data flows between zones, trust levels and the controls on each boundary.
- Scenario fit: Part 3 helps you avoid designing from scratch. Map your environment to its scenarios, then choose the control set for each.
- Operate and review: Part 4 explicitly covers operation, monitoring and review of gateway controls, which is where most firewall estates decay.
Identity and NHI requirements
The series is about networks, but network controls are full of non-human identities: device certificates, VPN pre-shared keys, RADIUS shared secrets, API tokens for firewall orchestration, SNMP community strings and the service accounts that back up device configurations. Edge devices are a frequent initial access route (ATT&CK T1190 Exploit Public-Facing Application and T1133 External Remote Services), and once inside, attackers reuse the credentials those devices hold.
| 27033 area | Machine credential | Control |
|---|---|---|
| Security gateways (Part 4) | Management API tokens, administrator accounts, TLS inspection private keys | Short-lived tokens from a vault; management plane on a dedicated network; inspection keys in hardware where supported |
| VPNs (Part 5) | IKE pre-shared keys, gateway and client certificates, LDAP or RADIUS bind accounts | Prefer certificates to shared keys; certificate inventory with expiry tracking; least-privilege bind accounts |
| Wireless (Part 6) | RADIUS shared secrets, device certificates for EAP-TLS, controller admin accounts | Per-device certificates rather than shared passphrases for corporate SSIDs; rotate RADIUS secrets |
| Virtualisation (Part 7) | SDN controller service accounts, orchestration API keys, cloud network IAM roles | Scoped roles; alert on changes to routing, security groups and peering by non-human principals |
| Device management (all parts) | SSH keys, SNMP credentials, configuration backup accounts | SNMPv3 instead of community strings; SSH keys with owners; secrets in a vault, not in scripts |
Network location is no longer enough to grant trust. Authenticate workloads to each other cryptographically (see the mTLS Guide), and see the Network Device Management Plane Hardening Guide for device administration and the Ivanti Connect Secure Hardening and Integrity Checking Guide for one widely targeted VPN platform.
Implementation steps
- Scope and inventory. List network zones, connections to third parties and the internet, remote access paths, wireless networks and virtual networks. Include every network device and its management interface.
- Assess risk (Part 1). Identify threats per zone and boundary, including adversary-in-the-middle (T1557), network sniffing (T1040) and lateral movement through remote services (T1021). Derive requirements and agree risk owners.
- Design and document (Part 2). Produce a zone and conduit model, permitted flows, trust levels and boundary controls. Record design decisions and rejected alternatives.
- Check against scenarios (Part 3). Compare each environment with the reference scenarios and confirm the control set covers the scenario's threats.
- Apply technology parts (4 to 7). Use Part 4 for gateway rule design and management, Part 5 for VPN choices, Part 6 for wireless, Part 7 for SDN and cloud virtual networks.
- Roll out in stages. Introduce new segmentation or gateway policy in monitor or log-only mode first, review hits for two to four weeks, then enforce per zone. Keep the previous rule set exported and a tested rollback window for each change.
- Secure the management plane and machine credentials. Move device administration to a dedicated network, put credentials in a vault, replace shared keys with certificates and enable configuration change logging.
- Operate and review. Schedule rule recertification, VPN and wireless configuration reviews, and device firmware patching. See the Firewall Rule Review Checklist.
Decision guidance
- Small organisations: Part 1 and the relevant technology part are usually enough. Focus on a handful of zones, a managed firewall, certificate-based VPN or ZTNA, and WPA3 Enterprise or WPA2 Enterprise with 802.1X for staff Wi-Fi.
- Large and multi-cloud estates: Parts 2, 3 and 7 matter most. The hard problem is consistent policy across data centre, cloud VPCs or VNets and SD-WAN. Treat network policy as code with review and drift detection.
- VPN or ZTNA for remote access: Part 5 still applies to site-to-site links. For user and partner access, identity-aware access per application reduces lateral movement compared with full network VPN. See the SASE and SSE Guide and the NIST SP 800-207 Zero Trust Architecture Guide.
- Perimeter or microsegmentation: keep gateways at external and inter-zone boundaries, and add microsegmentation where workloads of different sensitivity share a network.
Evidence and assessment
Assessors look for 27033-style evidence during ISO/IEC 27001 audits of the network controls, PCI DSS assessments and customer reviews.
| Evidence | What an assessor checks |
|---|---|
| Network security policy and architecture principles | Approved, reviewed, linked to risk assessment |
| Zone diagram and data flow inventory | Current, matches device configuration, third-party connections included |
| Firewall and gateway rule base with owners and review dates | No unexplained any-any rules; recertification records |
| VPN and wireless configuration standards | Strong authentication, certificate use, cipher policy |
| Network device inventory and credential register | Every device has an owner, firmware level and managed credentials |
| Monitoring and change logs | Device logs centralised, configuration changes alerted and reconciled with change tickets |
Metrics
- Rule hygiene: percentage of firewall rules with an owner and a review in the last 12 months; count of shadowed or unused rules.
- Segmentation coverage: percentage of high-value systems behind an enforced segmentation boundary.
- Edge device exposure: mean time to patch internet-facing network devices after a vendor security advisory.
- Credential hygiene: percentage of network devices with vault-managed credentials and no shared or default secrets.
- Unauthorised change rate: configuration changes without a matching change record.
Mapping to other frameworks
CSF 2.0, SP 800-53 and ATT&CK identifiers were checked against the official datasets.
| 27033 topic | ISO/IEC 27001:2022 Annex A | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|---|
| Network risk and architecture (Parts 1 to 3) | 8.20 Networks security; 8.22 Segregation of networks | PR.IR-01, ID.RA-01 | SC-7, AC-4 |
| Security gateways (Part 4) | 8.20; 8.21 Security of network services | PR.IR-01, DE.CM-01 | SC-7, SI-4, CM-7 |
| VPNs (Part 5) | 8.20; 8.24 Use of cryptography; 6.7 Remote working | PR.DS-02 | AC-17, SC-8 |
| Wireless (Part 6) | 8.20 | PR.IR-01 | AC-18, IA-3 |
| Virtualisation (Part 7) | 8.22; 5.23 Information security for use of cloud services | PR.IR-01 | SC-7, AC-4 |
| Monitoring | 8.16 Monitoring activities | DE.CM-01 | SI-4 |
CIS Controls v8.1 Control 12 (Network Infrastructure Management) and Control 13 (Network Monitoring and Defense) cover similar ground at safeguard level. See the CIS Controls Guide.
Common pitfalls
- Citing the series without reading the right part. Policies that say "network security follows ISO/IEC 27033" with no indication of which part governs firewalls, VPNs or wireless give auditors nothing to test.
- Designs that stop at the perimeter. A strong internet gateway with a flat internal network leaves lateral movement unchecked.
- Unmanaged edge device credentials. VPN appliances with local admin accounts, shared keys and unpatched firmware are a repeated initial access route.
- Rule bases that only grow. Rules added for projects are never removed; the operate-and-review stage of Part 4 is skipped.
- Virtual networks outside the model. Cloud security groups, peering and SDN policies managed by separate teams and never included in the zone design.
- Treating old editions as obsolete. A 2010 or 2013 date does not mean withdrawn; check the catalogue status before discarding a part or claiming it is current.
Practitioner checklist
- Record which ISO/IEC 27033 part and edition governs each network domain in your policy.
- Maintain a current zone model and data flow inventory, including cloud and third-party connections.
- Tie network security requirements to the ISMS risk assessment, with named risk owners.
- Recertify firewall and gateway rules at least annually and remove unused rules.
- Use certificates rather than pre-shared keys for VPNs and corporate Wi-Fi, with expiry tracking.
- Put network device credentials, API tokens and SNMP secrets in a vault and rotate them.
- Place device management interfaces on a dedicated network and log every configuration change.
- Patch internet-facing network devices to a defined service level after vendor advisories.
- Include virtual networks and SDN policy in the same design and review process.
Standards and references
- ISO: ISO/IEC 27033-1:2015 Network security, Part 1: Overview and concepts
- ISO: ISO/IEC 27033-2:2012 Guidelines for the design and implementation of network security
- ISO: ISO/IEC 27033-3:2010 Reference networking scenarios
- ISO: ISO/IEC 27033-4:2014 Securing communications between networks using security gateways
- ISO: ISO/IEC 27033-5:2013 Securing communications across networks using VPNs
- ISO: ISO/IEC 27033-6:2016 Securing wireless IP network access
- ISO: ISO/IEC 27033-7:2023 Guidelines for network virtualization security
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Network Security Guide · Network Segmentation Guide · Firewall Management Guide · Network Device Management Plane Hardening Guide